CVE-2020-11071 - Vulnerability Details - OpenCVE

ReportizFlow

SLPJS (npm package slpjs) before version 0.27.2, has a vulnerability where users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user's minting baton. This is fixed in version 0.27.2.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:L/Au:N/C:N/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Simpleledger	Slpjs

Configuration 1 [-]

cpe:2.3:a:simpleledger:slpjs:*:*:*:*:*:node.js:*:*

No data.

References

Link	Providers
https://github.com/simpleledger/slpjs/commit/3671be2ffb6d4cfa94c00c6dc8649d1ba1d75754
https://github.com/simpleledger/slpjs/security/advisories/GHSA-jc83-cpf9-q7c6

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2020-05-12T00:25:15

Updated: 2024-08-04T11:21:14.616Z

Reserved: 2020-03-30T00:00:00

Link: CVE-2020-11071

Vulnrichment

No data.

NVD

Status : Modified

Published: 2020-05-12T01:15:11.150

Modified: 2024-11-21T04:56:43.487

Link: CVE-2020-11071

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "slpjs", "vendor": "simpleledger", "versions": [{"status": "affected", "version": "< 0.27.2"}]}], "descriptions": [{"lang": "en", "value": "SLPJS (npm package slpjs) before version 0.27.2, has a vulnerability where users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user's minting baton. This is fixed in version 0.27.2."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-697", "description": "CWE-697: Incorrect Comparison", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-05-12T00:25:15", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/simpleledger/slpjs/security/advisories/GHSA-jc83-cpf9-q7c6"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/simpleledger/slpjs/commit/3671be2ffb6d4cfa94c00c6dc8649d1ba1d75754"}], "source": {"advisory": "GHSA-jc83-cpf9-q7c6", "discovery": "UNKNOWN"}, "title": "False-negative validation results in MINT transactions with invalid baton", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2020-11071", "STATE": "PUBLIC", "TITLE": "False-negative validation results in MINT transactions with invalid baton"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "slpjs", "version": {"version_data": [{"version_value": "< 0.27.2"}]}}]}, "vendor_name": "simpleledger"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "SLPJS (npm package slpjs) before version 0.27.2, has a vulnerability where users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user's minting baton. This is fixed in version 0.27.2."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-697: Incorrect Comparison"}]}]}, "references": {"reference_data": [{"name": "https://github.com/simpleledger/slpjs/security/advisories/GHSA-jc83-cpf9-q7c6", "refsource": "CONFIRM", "url": "https://github.com/simpleledger/slpjs/security/advisories/GHSA-jc83-cpf9-q7c6"}, {"name": "https://github.com/simpleledger/slpjs/commit/3671be2ffb6d4cfa94c00c6dc8649d1ba1d75754", "refsource": "MISC", "url": "https://github.com/simpleledger/slpjs/commit/3671be2ffb6d4cfa94c00c6dc8649d1ba1d75754"}]}, "source": {"advisory": "GHSA-jc83-cpf9-q7c6", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T11:21:14.616Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/simpleledger/slpjs/security/advisories/GHSA-jc83-cpf9-q7c6"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/simpleledger/slpjs/commit/3671be2ffb6d4cfa94c00c6dc8649d1ba1d75754"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2020-11071", "datePublished": "2020-05-12T00:25:15", "dateReserved": "2020-03-30T00:00:00", "dateUpdated": "2024-08-04T11:21:14.616Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:simpleledger:slpjs:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "035AB245-62DC-434B-A63F-D1AC45D95DFC", "versionEndExcluding": "0.27.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "SLPJS (npm package slpjs) before version 0.27.2, has a vulnerability where users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user's minting baton. This is fixed in version 0.27.2."}, {"lang": "es", "value": "SLPJS (paquete slpjs de npm) versiones anteriores a 0.27.2, presenta una vulnerabilidad donde los usuarios podr\u00edan experimentar resultados de comprobaci\u00f3n falsos negativos para las operaciones de transacci\u00f3n MINT. Una billetera SLP mal implementada podr\u00eda permitir el gasto de los tokens afectados, lo que resultar\u00eda en la destrucci\u00f3n minting baton del usuario. Esto es corrigido en la versi\u00f3n 0.27.2."}], "id": "CVE-2020-11071", "lastModified": "2024-11-21T04:56:43.487", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "[email protected]", "type": "Primary"}]}, "published": "2020-05-12T01:15:11.150", "references": [{"source": "[email protected]", "tags": ["Patch", "Tool Signature"], "url": "https://github.com/simpleledger/slpjs/commit/3671be2ffb6d4cfa94c00c6dc8649d1ba1d75754"}, {"source": "[email protected]", "tags": ["Tool Signature"], "url": "https://github.com/simpleledger/slpjs/security/advisories/GHSA-jc83-cpf9-q7c6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Tool Signature"], "url": "https://github.com/simpleledger/slpjs/commit/3671be2ffb6d4cfa94c00c6dc8649d1ba1d75754"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Tool Signature"], "url": "https://github.com/simpleledger/slpjs/security/advisories/GHSA-jc83-cpf9-q7c6"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-697"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-697"}], "source": "[email protected]", "type": "Primary"}]}